Rusty-Playground - Some Rust program I wrote while learning Malware D

项目说明

Rusty-Playground :crab:

----

| Tool | Description | Reference(s) |
|---------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| ClipboardMon | Monitors the clipboard for changes and logs clipboard content or copies files depending on detected changes. | - |
| DumpMDEConfig | Enumerates Microsoft Defender to identify exclusion paths, allowed threats, protection history, and ASR (Attack Surface Reduction) rules enabled on the system. No admin pri required. | Source |
| Ele | Impersonates user tokens to create processes with elevated system pri. | Token::elevate |
| HashMiner | Extract NTLM Hashes from SAM and SYSTEM | mimikatz-rs
| HeapEnc | Demonstrates a simple example of heap encryption. | nimHeapEnc |
| HideDll | Hides DLLs in the current process and employs anti-analysis methods to prevent the DLL from being dumped by memory scanners. | - |
| HookFinder | Detects userland API hooks implemented by antivirus or EDR (Endpoint Detection and Response) software. | - |
| IoDllProxyLoad | Uses Windows thread pool API to proxy the loading and unloading of a DLL via an I/O completion callback function using named pipes. | IoDllProxyLoad <br> weaponizing-windows-thread-pool-apis-proxying-dll-loads |
| NtCreateUserProcess | Spawns processes using NtCreateUserProcess, blocks DLLs, and performs PPID (Parent Process ID) spoofing. | ntcreateuserprocess_1 <br> ntcreateuserprocess_2 |
| PatchlessAmsiBypass | Bypasses AMSI (Antimalware Scan Interface) utilizing hardware breakpoints, a in-memory hooks. | patchless_amsi |
| PatchlessBypass | An impro of PatchlessAmsiBypass, patches both ETW (Event Tracing for Windows) and AMSI on all threads. | PatchlessHook |
| PolyRust | Polymorphic Signature Change. | - |
| SelfErase | Deletes the currently running file from disk. | self_remove <br> delete-self-poc |
| SilentFart | Uses NTAPI to retrie and unhooks it without triggering the "PspCreateProcessNotifyRoutine" callback. | GhostFart |
| StackEncrypt | Shuffles and encrypts the stack, then sleeps using indirect syscalls to NtDelayExecution. | StackMask |
| Stringnalyzer | Payload string analyzers. | - |
| UnhookNtdll | Implements the Perun's Fart technique in Rust using NtCreateUserProcess, supporting both local and remote execution. | arsenal-rs |
| USB_mon | Monitors USB devices and displays information about new devices connected to the system. | - |
| | Le the Exception Handler (VEH) to modify the context, particularly the RIP register, to invoke LoadLibraryA with the RCX register holding its argument (module name). Triggers exceptions using to set pages to PAGE_GUARD. | .c |
| Whoami_alt | Provides alternatives to the whoami command by utilizing uncommon WinAPI functions. | WhoIsWho <br> WhoamiAlternatives |
| Whoami_alt2 | Additional alternatives to the whoami command, le uncommon WinAPI functions. | WhoIsWho <br> WhoamiAlternatives |
| Wifi-Dump | Dumps WiFi passwords using WinAPI. | - |

项目信息

开发语言：Rust

Star 数：162

技术要点

该项目属于病毒分析方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Some Rust program I wrote while learning Malware Development 展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。